Turkish companies serving global clients now operate at the intersection of three separate frameworks: the EU AI Act for artificial intelligence systems, the GDPR for European data subjects, and Turkey's KVKK for domestic activities. Although these three texts are built on different logics, they can be harmonised within a single governance framework. This guide addresses how a software, consulting, or SaaS company can manage this triangle.
Three Regulations, Three Different Logics
Each regulation has a different focus and logic of protection; understanding these differences is the foundation of any compliance strategy.
- EU AI Act: Adopts a risk-based approach. It classifies AI systems by risk level and sets obligations accordingly. It covers only AI systems.
- GDPR: A principle-based data protection regime. It covers anyone processing the personal data of EU data subjects, whether or not AI is involved.
- KVKK: Turkey's data protection law; it carries principles similar to the GDPR and, with the 2024 reform, moved to a tiered system for cross-border transfers.
If an AI feature both processes personal data and is offered to the EU market, all three regulations can apply at once.
The EU AI Act's Risk-Based Classification
The EU AI Act sorts AI systems into four risk categories. Obligations increase as the category rises.
| Risk Level | Example | Core Obligation |
|---|---|---|
| High | Recruitment, credit scoring, biometrics | Strict compliance, documentation, human oversight |
| Limited | Chatbots, content generation | Transparency (inform the user) |
| Minimal | Spam filters, in-game AI | Free to use, voluntary good practices |
The critical point for Turkish companies is this: if a system is offered to the EU market or its outputs are used in the EU, the EU AI Act obligations may apply even if the company is located in Turkey.
Where Does the Triangle Intersect?
Although the three regulations operate independently, in practice they meet in the same data flow. For example, an AI tool that evaluates the resumes of candidates in the EU:
- May be a high-risk system under the EU AI Act (recruitment).
- Is subject to profiling and automated decision-making rules under the GDPR.
- Under KVKK, if the data is processed in Turkey, cross-border transfer and automated processing provisions come into play.
This intersection calls for a single integrated governance framework rather than separate compliance projects.
Harmonising Within a Single Governance Framework
Managing the three regulations as separate silos raises both cost and error risk. Instead, build a single framework on shared building blocks.
- Build an inventory. List all systems that process personal data and involve AI in one inventory.
- Run risk and impact assessments. Conduct the data protection impact assessment for GDPR/KVKK and the EU AI Act risk classification in the same process.
- Establish the legal basis. Clarify bases such as explicit consent, contract, or legitimate interest for each processing activity.
- Ensure transparency. Inform users that they are interacting with AI and how their data is processed.
- Set up human oversight. Define meaningful human oversight and an objection mechanism for high-risk systems.
- Secure transfers. For cross-border transfers without an adequacy decision, use appropriate safeguards such as the standard contract.
- Document accountability. Keep all decisions, tests, and documentation audit-ready.
Practical Priorities for Turkish Companies
- Clarify whether your systems are offered to the EU market; the scope decision determines the obligations.
- Identify high-risk use cases early; these carry the heaviest obligations.
- Clarify contractual responsibilities with your third-party AI providers acting as processors.
- Map KVKK cross-border transfer safeguards to your AI data flows.
- Establish an AI governance policy and a model inventory.
Clarifying Roles and Responsibilities
The AI value chain has several actors: the provider who develops the model, the company that integrates it into its product, and the end user. Compliance obligations are shared across these roles, and each role carries different responsibilities.
- Provider: The party that develops or places the model on the market; bears the weight of technical documentation and conformity assessment.
- Deployer: The company that uses the system in its own processes; is responsible for human oversight, transparency, and use in line with the intended purpose.
- Controller/processor: Under the GDPR and KVKK, obligations are set according to the personal-data processing role.
Turkish companies are often both deployer and controller at the same time. Clearly defining these roles and the allocation of responsibility in contracts prevents disputes that might arise later.
Example Scenario
An Istanbul-based SaaS company offers its European clients an AI module that prioritises job applications. The module processes the data of candidates in the EU and its decisions are used in the EU.
The company applies the integrated framework as follows: it first adds the system to the inventory and classifies it as high-risk (recruitment) under the EU AI Act. In the same process it runs a data protection impact assessment for GDPR and KVKK; it sets up meaningful human oversight and an objection mechanism for profiling and automated decision-making. Candidates are transparently informed that an AI tool is used in the evaluation. Since the data is also processed in Turkey, the standard contract safeguard is engaged for the cross-border transfer. All decisions are documented in a single accountability file.
Frequently Asked Questions
Why would a company in Turkey have to comply with the EU AI Act?
The EU AI Act looks not at where you are located geographically but at whether the system is offered to the EU market or its outputs are used in the EU. For this reason a Turkey-based company may fall within scope when it serves clients in the EU.
Do I have to comply with the GDPR and KVKK separately?
The two regimes rest on similar principles, so it is possible to build a shared framework. However, they are not identical; there are differences especially in cross-border transfer, explicit consent, and notification procedures. Build a shared framework, but also meet each regime's specific requirements separately.
Is it realistic to manage all three in one framework?
Yes. Building blocks such as inventory, risk assessment, transparency, human oversight, and accountability are common to all three regulations. A single governance framework built on these shared foundations reduces duplication and ensures consistency.
How do I tell whether I have a high-risk AI system?
Systems used in sensitive decision areas such as recruitment, credit scoring, and biometric recognition are typically high-risk. Classify the risk by assessing the intended purpose and the rights of the people affected; where there is uncertainty, be conservative and apply the higher-category requirements.
This content is for general information purposes only and does not constitute legal advice.
Request a demo of JUS. today to manage your AI inventory, risk classifications, and KVKK-GDPR compliance processes under one roof.